It is possible to "Lock" the controller from the Measurement and Automation Explorer program. The password you set when locking the controller (which prevents others from making configuration changes to the controller while running) is the same password that controls access to the FTP server. When the controller is unlocked, anyone who can access the PXI controller's IP can read, write, and delete files on the FTP server. When locked, anyone can read data from the FTP server, but only when logged in with the lock password will you have access to write or delete data.
For more information on locking your controller, see the user manual, MAX online help, or the following link.
NI Developer Zone: Controlling Access to LabVIEW Real-Time PXI Targets